|RE: [equinox-dev] Granting permissions for usage of Bundle|
John Wells (Aziz)
From: equinox-dev-bounces@xxxxxxxxxxx [mailto:equinox-dev-bounces@xxxxxxxxxxx] On Behalf Of Srijith Kochunni
Sent: Wednesday, April 16, 2008 4:48 AM
To: Equinox development mailing list
Subject: Re: [equinox-dev] Granting permissions for usage of Bundle
Thanks for your prompt reply. So the best practice is to have a management agent set of bundles maintaining policy information and responsible for managing the other bundles, which is great.!
Regarding the other question, pardon me but I am not able to understand the term "super user" . Are you referring to the management bundle here.?
[jwells] Yes, I think that is what he's saying. Basically he's saying that the management bundle, since it must have AllPermission, is like a superuser in that it is not restricted from any operation.
Also let us say I export a service instead of a package, then is it possible for a separate management agent to enforce that only a particular bundle B can consume my service. Are the security conditions and permissions different for a service and package.
[jwells] Yes, there is both a ServicePermission and a PackagePermission and they are different things!
>>> BJ Hargrave <hargrave@xxxxxxxxxx> 04/15/08 7:34 PM >>>
In general, the management of permission is best done by a management agent: a bundle (or set of bundles) tasked with managing the set of installed bundles including the security policy. Enforcing permissions of course means that a SecurityManager is installed.
In order to modify the permissions on CPA, the caller must have AllPermission. So, in your example, bundle A would need AllPermission to modify the permissions so that only bundle B can import a specific package. Bundle A is then a "super user" which seems wrong.
office: +1 386 848 1781
mobile: +1 386 848 3788
"Srijith Kochunni" <ksrijith@xxxxxxxxxx>
2008/04/15 07:03 AM
[equinox-dev] Granting permissions for usage of Bundle
I have a bundle(A) from which I am exporting a package. I want to ensure that this package can be imported only by another particular bundle(B) in the OSGi runtime. Have been reading the spec about Conditional Permission Admin Service and Permission Admin Service, but am finding it difficult to understand whether they do provide such a facility and if so how it can be achieved using these core services.
Again I do not want to use a separate Management Agent bundle to enforce this scenario, unless there is no other option. It would be better if I could achieve this by writing code in my consumed bundle alone. Any links to examples for using Permission Admin Service / Conditional Permission Service would also be helpful.
equinox-dev mailing list